Skip to main content
brendonm11
brendonm11
New Member
February 5, 2018
Solved

LAN Connections

  • February 5, 2018
  • 1 reply
  • 18608 views

Hi All,

I'm the network administrator at a school. We recently got a Fortigate 30E device to control the network. 

 

I need help with the Fortigate. I'm struggling to create an IPv4 Policy to allow staff to access the internet all the time and disallow students to access the internet on certain times. 

I know how to do the scheduling and groups from the Active Directory. 

 

My concern, however, is that some staff members work on LAN connected devices... These LAN devices are not joined to the domain. 

 

By the IPv4 Policy when selecting the source, I select the source as Staff (from the Active Directory group) and NONE. When I apply the policy, LAN connected devices have no access to the internet... I have added their MAC and IP Addresses to the Custom Devices and added them to the policy as the source, but still no internet. 

 

Any help regarding this please??

 

 

Thanks in advance :) 

 

 

 

    Best answer by romanr

    Hey,

     

    if it is to ease your setup:

     You can use a device policy for those 2 devices and set it before the authentication rules..

     

    Have a look at:

    https://docs.fortinet.com/uploaded/files/2804/fortigate-managing-devices-54.pdf

     

    Br,

    Roman

    1 reply

    ede_pfau
    SuperUser
    ede_pfau
    SuperUser
    February 5, 2018

    hi,

     

    for those devices which are not part of the AD domain you could

    1- create local accounts and a local usergroup

    and

    2- set up a captive portal where users first have to authenticate via browser before they are allowed to use the internet.

    FSSO via AD is quite convenient but by no means the only way to authenticate against a FGT.

    brendonm11
    brendonm11Author
    New Member
    February 5, 2018

    If I do your method, would those PCs be required to logon often through Captive Portal?? Or can I set those users to be logged on for a long period (eg. a whole school term?)

     

    ede_pfau
    SuperUser
    ede_pfau
    SuperUser
    February 5, 2018

    An important feature of the security provided by authentication is that it is temporary—a user must reauthenticate after logging out. Also if a user is logged on and authenticated for an extended period of time, it is a good policy to have them re-authenticate at set periods. This ensures a user’s session is cannot be spoofed and used maliciously for extended periods of time — re-authentication will cut any spoof attempts short. Shorter timeout values are more secure.

    You set the security user authentication timeout to control how long an authenticated connection can be idle before the user must authenticate again. The maximum timeout is 1440 minutes (24 hours).

    Terms & ConditionsAccessibility statement